JWT Decoder
JWT Decoder — runs in your browser. Inputs are not stored.
JWT decoder
Signatures are not verified. Use a server-side tool if you need HMAC verification.
How to use
- Paste a token string split by three dots into the JWT field.
- Click Decode and Header and Payload are filled as readable JSON.
- Signature (raw) shows the third segment as-is, or “none” if it is missing.
- If there are fewer than two dots, the status area explains that it is not a valid format.
- Click Reset to clear the fields. This tool has no copy button.
Key concepts
A JWT decoder is a lookup tool that Base64URL-decodes the header and payload so you can read them. It does not verify the signature with an algorithm and key, so you cannot treat the claims on screen as untampered. Use a JWT decoder to inspect expiry, issued-at, and permission fields while debugging, and decide real trust with HMAC or public-key verification on the server. The third segment is only shown as raw text. If the value is split by two dots, the header and payload are still read, and an empty signature is shown as none.
Even after a successful decode, the status area still says the signature was not verified. If the payload is JSON it is indented; otherwise the decoded text is left as-is. This JWT decoder does not take a secret key and does not upload the token to a server. When you paste a production token, claims can still be visible after expiry, so check sensitive values locally only and close the page. If the format is wrong, the status area turns red and the header and payload fields may not overwrite previous values, so reset and try again.
Example
Paste a sample in header.payload.signature form and click Decode: Header shows an algorithm object and Payload shows indented claims. A string with only one dot raises an error that a JWT must be in header.payload.signature form.
Related: JSON formatter · htpasswd generator · JSON encoder
Frequently asked questions
Does the JWT decoder verify the signature?
No. It only reads the header and payload, and the signature field shows the third segment as raw text. Do HMAC verification on the server.
Does the JWT decoder accept a token with only two dots?
If only the header and payload are present, it still tries to decode. If the third segment is missing, the signature field shows none.
What if Base64URL decode fails in the JWT decoder?
The status area shows a Base64URL decode failure or a related error in red, and you should not trust the header or payload.
Is the JWT decoder payload always shown as JSON?
If it parses as JSON it is indented; otherwise the decoded string is shown as-is.
Is a token pasted into the JWT decoder sent to a server?
No. Decoding happens only in the browser, and there is no key field. Reset clears all four fields.
Why is there no copy-result button on the JWT decoder?
Header, payload, and signature each have their own field, so there is no copy button. Select the text in the field you need.
Last reviewed: 2026-09-04